Nice Attacks — but What is the Cost? Computational Models for Cryptanalysis
Résumé
This paper discusses the implications of choosing a computational model to
study the cost of cryptographic attacks and therefore quantify how dangerous
they are. This choice is often unconscious and the chosen model itself is
usually implicit; but it has repercussions on security evaluations.
We compare three reasonable computational models: $i$) the usual Random Access
Machine (RAM) model; $ii$) the ``Expensive Memory Model'' explicitly introduced by
several 3rd-round submissions to the Post-Quantum NIST competition (it states
that a single access to a large memory costs as much as many local
operations); $iii)$ the venerable VLSI model using the Area-Time cost
measure.
It is well-known that costs in the RAM model are lower that costs in the last
two models. These have been claimed to be more realistic, and therefore to
lead to more precise security evaluations. The main technical contribution of
this paper is to show that the last two these models are incomparable. We
identify a situation where the expensive memory model overestimates costs
compared to the (presumably even more realistic) VLSI model.
In addition, optimizing the cost in each model is a distinct objective that
leads to different attack parameters, and raises the question of what is the
``best'' way to proceed for an eventual attacker. We illustrate these
discrepancies by studying several generic attacks against hash function and
Feistel networks in the three models.
Domaines
Cryptographie et sécurité [cs.CR]
Origine : Fichiers produits par l'(les) auteur(s)